A reported $9.3 million drain from More Markets is a reminder that DeFi lending losses do not always begin with an obvious software failure. Sometimes the dangerous component is an assumption embedded in the protocol’s risk settings.
According to Cointelegraph, citing blockchain security firm Blockaid, an attacker used an Ankr liquid staking token and an efficiency mode, commonly called E-mode, to overborrow from More Markets. The activity reportedly drained about $9.3 million in wrapped FLOW, or WFLOW, from a lending reserve.
The incident occurred outside Ethereum itself, but the design lesson belongs squarely in the Ethereum and Layer 2 conversation. Lending systems across the broader smart-contract economy have adopted features intended to improve capital efficiency for assets presumed to move together. Liquid staking tokens, wrapped assets and other derivative representations are often central to those systems.
That combination can work well under normal conditions. It can also magnify losses when the relationship between two assets is weaker than the protocol’s parameters assume.
For users, the important question is therefore not only whether a lending contract has been audited. It is whether the protocol has correctly modeled what its collateral represents, how reliably it can be priced and what happens when a supposedly correlated market stops behaving as expected.
E-mode makes the collateral assumption more important
Efficiency modes are designed to let borrowers obtain more credit against groups of closely related assets. In general, a protocol can justify more generous borrowing terms when collateral and borrowed assets are expected to maintain a stable relationship.
The capital benefit is straightforward. A user holding one representation of an asset may be able to borrow another related asset with less idle collateral than a standard lending market would require. That can make refinancing, hedging and leveraged strategies more efficient.
But higher efficiency means a thinner margin for error.
When a lending market increases borrowing capacity, it is effectively expressing greater confidence in several things at once: the collateral’s price, its liquidity, its redeemability and its relationship to the borrowed asset. If any of those assumptions fail, the protocol has less protection before a position becomes undercollateralized.
The reported More Markets drain illustrates the consequence at the reserve level. Blockaid’s account, as relayed by Cointelegraph, says an attacker combined an Ankr liquid staking token with E-mode to overborrow and remove roughly $9.3 million in WFLOW.
The available source context does not establish whether the root cause was a pricing problem, a configuration failure, inadequate liquidity controls or another weakness. It would be irresponsible to assign a precise technical cause without a full postmortem. What the report does establish is the relevant design pattern: derivative collateral, enhanced borrowing power and a reserve large enough to absorb the result.
Liquid staking tokens carry multiple layers of risk
Liquid staking tokens are often described as claims on staked assets. That shorthand is useful, but incomplete.
A user assessing one of these tokens must consider more than the underlying asset’s market price. The token can also depend on an issuer or protocol, redemption mechanics, smart contracts, validators, bridges and secondary-market liquidity. Which dependencies matter will vary by product and chain.
Those layers become more consequential when a lending protocol treats the token as close enough to another asset to qualify for preferential borrowing terms.
A quoted market price does not by itself prove that a large position can be liquidated near that price. Nor does a theoretical redemption route guarantee immediate conversion during market stress. If liquidators cannot sell collateral efficiently, a lending protocol can be left with debt that exceeds what it can recover.
Wrapped and rehypothecated tokens complicate market visibility further. CoinGecko has separately announced changes to how it categorizes and ranks rehypothecated assets, reflecting the difficulty of representing derivative tokens accurately in market data. That is not evidence about the cause of the More Markets incident, but it points to the same broader problem: token wrappers can make economic exposure look simpler than it is.
For Ethereum and Layer 2 users, this matters because composability encourages the same asset to appear in several forms across multiple applications. A staking receipt may become lending collateral, a liquidity-pool component or backing for another token. Each additional use can create another dependency without creating new underlying collateral.
The result is not necessarily unsafe. It is, however, harder to evaluate from a token ticker or headline yield.
An audit cannot settle a risk-parameter question
Smart-contract audits remain important, but they answer a narrower question than many users assume.
An audit may identify coding errors and unsafe contract behavior within its scope. It does not guarantee that a protocol’s collateral factors are prudent, its oracle inputs reflect executable market prices or its liquidation incentives will work during stress.
Those are economic and operational questions.
A lending market can function exactly as configured while still producing a large loss if its configuration permits too much borrowing against weak or manipulable collateral. Conversely, conservative limits can contain the effect of a flawed asset even when an exploit attempt occurs.
That distinction should shape how depositors evaluate lending protocols. The presence of E-mode is not itself a warning sign; it is a reason to inspect the details. Users need to know which assets are grouped together, how much extra borrowing capacity the mode permits and whether the protocol caps exposure to any one collateral type.
They should also ask whether the lending reserve is isolated from more experimental markets. A protocol that lets a weak collateral asset drain a broadly funded reserve exposes passive suppliers to decisions they may not realize they are underwriting.
What depositors should examine
Retail users cannot reproduce a professional security review, but they can ask several practical questions before supplying assets to a lending market:
- What can borrow against the reserve? Depositors should identify every accepted collateral asset, not only the asset they intend to supply. - Does the protocol offer preferential risk settings? E-mode, elevated loan-to-value limits and correlated-asset categories deserve additional scrutiny. - How liquid is the collateral in practice? Reported market value is less useful if liquidators cannot execute meaningful size. - Is the token redeemable, and under what conditions? Redemption delays or dependencies can matter during rapid deleveraging. - Are exposure caps visible? A cap can limit damage from one collateral market, although it does not eliminate risk. - Are risk changes documented? Users should be able to see when collateral parameters, oracle arrangements or borrowing limits change. - Is the reserve isolated? Segmentation can determine whether a problem remains local or reaches unrelated depositors.
None of these checks guarantees safety. They do help distinguish a plain lending position from a more complicated bet on protocol configuration and derivative collateral.
The lesson for Ethereum scaling is about shared risk
Ethereum’s rollup-centered ecosystem is built around applications that can integrate assets and contracts quickly. That composability remains a core advantage, but it can also transmit weak assumptions from one product into another.
A liquid staking token may be sound within its original system yet become dangerous when another protocol grants it aggressive borrowing power. A wrapped asset may track its reference asset reliably in routine trading but prove difficult to liquidate in size. A risk setting calibrated from calm market data may fail when activity concentrates around a single reserve.
The More Markets report should not be stretched into a claim that all efficiency modes or liquid staking tokens are unsafe. It supports a narrower conclusion: enhanced capital efficiency requires stronger evidence about collateral quality, not weaker safeguards.
For depositors, the grounded takeaway is that lending yield is compensation for more than borrower default. It also pays for exposure to the protocol’s asset listings, oracle design, liquidation market and parameter choices. When E-mode and derivative collateral are involved, those choices can determine whether a reserve remains solvent.